Start of new case 


Q1 


Q2 


Does the draft guidance cover the relevant issues about the right of access? 
O) Yes 
© No 


C) Unsure / don't know 
If no or unsure/don’t know, what other issues would you like to be covered in it? 


There is an issue of complexity for employers that | don't think is fully covered or explained within the 
guidance - see point 2. 


Does the draft guidance contain the right level of detail? 


Yes 


C) 
© No 
C) Unsure / don't know 


If no or unsure/don't know, in what areas should there be more detail within the draft 
guidance? 


There is a complex case example that | cannot resolve within the guidance provided: Many SAR cases 
are requests for correspondence about an employee/previous employee. These cases are made complex 
by the possibility of personal opinion of the data subject or about the data subject existing within any 
organisational emails (even where policy advises against it). However the organisation must review very 
large packages of generally organisational email correspondence to find whether such opinion has ever 
been written about the data subject because the data subject is entitled to 'all their data', that 'relates to 
them' and is 'held by the organisation'. Even where retention schedules are applied to email, the 
necessary factor of all data to be provided raises the expectation on an organisation to review all of their 
correspondence massively, and it would be useful for the ICO to address this expectation in area of 
‘complexity’ as the data is often not easy to identify. 


Q3 


Does the draft guidance contain enough examples? 


(_) Yes 

© No 

©.) Unsure / don't know 

If no or unsure/don’t know, please provide any examples that think should be included in 
the draft guidance. 

Please see Q2 example. 


Q4 We have found that data protection professionals often struggle with applying and 
defining ‘manifestly 


unfounded or excessive’ subject access requests. We would like to include a wide 
range of examples 

from a variety of sectors to help you. Please provide some examples of manifestly 
unfounded and excessive 

requests below (if applicable). 


Please see Q2 which I related to complexity. The requests usually come in the form 
of recent ex-employees that have worked for the organisation for many years and 
have asked for all correspondence that is about them. Our litigation hold period 
keeps emails in archive for 7 years. The requester can often be unwilling to define 
specific individuals, periods of time, or topics of conversation for us to refine the 
request. The data will most likely have been originally created by them as an 
employee of the organisation (their opinions) and the results are very rarely 


meaningful. An example, was reviewing 13,000+ emails which found <50 emails 
included non substantive personal data. 


Q5 Ona scale of 1-5 how useful is the draft guidance? 


3- 
1-Notatall 2-—Slightly Moderately 4-—Very 5- Extremely 


useful useful useful useful useful 


© 


Q6 Why have you given this score? 


All of the topics (bar my concern mentioned) are covered well and I feel like I 
understand the guidance presented. 


Q7 To what extent do you agree that the draft guidance is clear and easy to understand? 


Strongly Neither agree Strongly 
disagree Disagree nor disagree Agree agree 


© 


Q8 Please provide any further comments or suggestions you may have about the draft 
guidance. 


Q9 Are you answering as: 


ry An individual acting in a private capacity (eg someone providing their views as a 
— member of the public) 


© An individual acting in a professional capacity 
©) On behalf of an organisation 

C) Other 

Please specify the name of your organisation: 


Q10 How did you find out about this survey? 
C) ICO Twitter account 
(_) ICO Facebook account 
(C) ICO LinkedIn account 
© ICO website 
C) ICO newsletter 
©) ICO staff member 
(C) Colleague 
(_) Personal/work Twitter account 
©) Personal/work Facebook account 
©) Personal/work LinkedIn account 
©) Other 


Thank you for taking the time to complete the survey 


